Most password advice is outdated. The rules that dominated corporate IT policy for 20 years — mandatory special characters, forced rotation, complexity requirements — have been debunked by NIST, which now recommends the opposite approach. Here is what actually works.
NIST 2024 Guidelines: What Changed
NIST's 2024 Digital Identity Guidelines reversed decades of conventional wisdom. Key changes: length is the primary security factor (not complexity). Mandatory periodic password rotation is no longer recommended. Blocking common passwords (dictionary words, known breached passwords) matters more than character class requirements. Knowledge-based authentication questions should be eliminated.
Understanding Password Entropy
Entropy measures how unpredictable a password is — how many guesses an attacker would need to crack it. A 16-character random password drawn from a 95-character set (upper, lower, digits, symbols) has approximately 105 bits of entropy. At one trillion guesses per second, this would take longer than the age of the universe to crack by brute force.
The fastest way to generate a genuinely high-entropy password is with a tool that uses cryptographic randomness. The UltraToolkit Password Generator creates passwords with customisable length and character sets — all processing happens in your browser, so the password is never transmitted anywhere.
Why 'Pa$$w0rd' Is Weak Despite Meeting Complexity Rules
Password crackers have evolved to target character substitution patterns — replacing e with 3, a with @, s with $ — because humans apply these substitutions predictably. A password like Pa$$w0rd is cracked in milliseconds by modern tools despite technically meeting uppercase, lowercase, number, and symbol requirements.
The Case for Passphrases
A passphrase of four random words (correct-horse-battery-staple, famously) has approximately 44 bits of entropy using the Diceware word list — weak against a targeted attack but memorable. A truly random 16-character password is far stronger but requires a password manager to use effectively.
Password Managers: The Non-Negotiable Step
The single highest-impact security improvement most people can make is adopting a password manager. It solves the core problem: humans cannot remember 50 unique, high-entropy passwords. With a manager, you only memorise one strong master password. The manager generates and stores unique passwords for every service.
How Attackers Actually Crack Passwords
Understanding how password cracking works clarifies why certain practices are ineffective. Modern password cracking uses several distinct techniques depending on what information the attacker has. Dictionary attacks try every word in a curated wordlist — starting with the most common passwords, then dictionary words with common substitutions (e to 3, a to @, s to $), then combinations. John the Ripper and Hashcat, the two most widely used cracking tools, can test billions of variations per second on modern GPU hardware.
Credential stuffing takes a different approach — it uses actual username and password pairs from previous data breaches, available on dark web markets, and attempts them directly against other services. Since password reuse is so common, this attack is highly effective. The Have I Been Pwned database tracks over 12 billion breached credentials. If you reuse passwords, a breach at one service immediately compromises all services where you use the same credentials.
Brute force attacks systematically try every possible combination. For a 6-character password using lowercase letters only, there are 26^6 = 308 million combinations — crackable in seconds at modern speeds. An 8-character password with uppercase, lowercase, digits, and symbols has 95^8 = 6.6 trillion combinations — still crackable in minutes with dedicated hardware. A 16-character random password has 95^16 combinations — computationally infeasible to brute force with any foreseeable technology.
Generate cryptographically secure passwords with the UltraToolkit Password Generator. It uses the browser's built-in cryptographic random number generator — the same source used for secure key generation — and never transmits your password to any server.
The Passphrase Alternative
The Electronic Frontier Foundation's Diceware system generates passphrases by rolling physical dice and mapping results to words from a curated 7,776-word list. A 5-word Diceware passphrase (example: correct-horse-battery-staple) has approximately 64 bits of entropy — strong against brute force attack while being pronounceable and memorable. A 6-word passphrase reaches 77 bits, which is practically uncrackable by any current or foreseeable near-future hardware.
The advantage of passphrases over random character passwords is memorability — humans are far better at remembering word sequences than random character strings. The tradeoff is length: a 6-word passphrase is typically 30-40 characters, longer than most password fields historically supported. Most modern systems now support passwords of 64+ characters, making passphrases a practical option for master passwords and accounts where you cannot use a password manager.
Multi-Factor Authentication: The Security Layer Above Passwords
Even a perfect password provides limited protection if it can be phished — tricked out of you by a convincing fake website. Multi-factor authentication (MFA) adds a second verification factor that an attacker cannot obtain simply by knowing your password. The three categories of authentication factors are: something you know (password, PIN), something you have (hardware key, phone), and something you are (fingerprint, face scan).
Time-based One-Time Passwords (TOTP), used by authenticator apps like Google Authenticator and Authy, generate a new 6-digit code every 30 seconds using a shared secret key and the current timestamp. Intercepting a code provides no ongoing access since it expires in 30 seconds. FIDO2 hardware security keys (YubiKey, Google Titan Key) provide even stronger protection — they are immune to phishing because they cryptographically verify the domain name before responding.
SMS-based two-factor authentication — a code sent by text message — is significantly weaker than app-based or hardware-based MFA. SIM swapping attacks, where an attacker convinces a mobile carrier to transfer your number to their SIM card, can intercept SMS codes. For high-value accounts (email, banking, domain registrar), use app-based or hardware MFA instead of SMS wherever possible.
Organisational Password Policies: What Research Actually Supports
NIST Special Publication 800-63B, revised in 2024, represents the most research-backed password guidance available. Its recommendations contradict many established corporate policies. Mandatory periodic password rotation — changing passwords every 90 days — is no longer recommended. Research shows that forced rotation causes users to make minor, predictable changes (password1 becomes password2) and to write passwords down. NIST now recommends rotation only when there is evidence of compromise.
Complexity requirements that mandate specific character types — at least one uppercase, one number, one symbol — are also no longer recommended as a standalone measure. Users satisfy these requirements with predictable patterns (Password1! satisfies all requirements and is trivially cracked). Length is now recognised as the primary security factor. NIST recommends supporting passwords of at least 64 characters and checking new passwords against a list of known compromised passwords rather than enforcing character class rules.
Protecting Against Social Engineering Attacks on Passwords
Technical password security is only one layer of defence. Social engineering — manipulating people into revealing credentials — accounts for the majority of actual account compromises. Phishing, the most common form, presents a convincing fake login page for a service the target uses. The URL may be nearly identical to the real service (paypa1.com instead of paypal.com, or a long URL where the domain is buried). The login form looks identical to the legitimate one and captures the username and password before redirecting to the real site.
FIDO2 hardware security keys are the only authentication method that is completely immune to phishing. When you press the key to authenticate, it cryptographically verifies the actual domain of the requesting website and refuses to authenticate if it does not match the registered domain. No human can be tricked into authenticating a phishing site with a hardware key. For high-value accounts — your primary email, domain registrar, banking, and cloud provider accounts — a hardware security key is the strongest protection available.
Password Security for Shared Accounts and Teams
Team and organisational password management introduces challenges that individual password managers do not address. When an employee leaves a company, all shared credentials they had access to must be rotated. When a team uses a shared account (a social media account, a shared service login), everyone who has ever had the password remains a potential threat after their access is intended to be revoked. Business password managers including 1Password Teams, Bitwarden for Business, and Dashlane Business address these challenges with shared vaults, access controls, and audit logs of who accessed which credentials and when.
Privileged Access Management (PAM) systems take this further for IT infrastructure — they vault administrator credentials for servers, databases, and network equipment, automatically rotate them on a schedule, require approval workflows for access, and record session activity for audit purposes. For organisations that handle sensitive data, PAM is a security control that prevents the most damaging insider threat and post-breach lateral movement scenarios.
Password Security Audit: Assessing Your Current Exposure
A practical password security audit starts with checking your existing credentials against known breach databases. Have I Been Pwned (haveibeenpwned.com) allows you to check whether your email address appears in any known data breach. The site also provides a Pwned Passwords API that checks individual passwords against a database of 847 million compromised passwords — importantly, using a k-anonymity technique that sends only the first five characters of a SHA-1 hash, meaning the actual password never leaves your device.
For a systematic audit of all your accounts, export your credentials from your current password manager and check each unique password. Prioritise changing credentials for: accounts where the password appears in breach databases, accounts where you have reused a password used elsewhere, accounts with passwords under 12 characters, and accounts that protect financial, email, or identity information. An email account compromise is particularly damaging because email is the recovery mechanism for virtually all other accounts — losing control of email effectively loses control of everything connected to it.
Password Security for Developers: Storing User Passwords Correctly
Developers who build applications with user authentication are responsible for protecting user passwords even in the event of a database breach. The correct approach is one-way hashing using a purpose-built password hashing algorithm — never encryption (which is reversible), and never MD5 or SHA-256 (which are fast general-purpose hash functions, easily brute-forced). The three recommended password hashing algorithms for new systems are Argon2id (the winner of the 2015 Password Hashing Competition, recommended by OWASP as the first choice), bcrypt (widely supported, battle-tested since 1999, still appropriate when configured with a sufficient cost factor), and scrypt (memory-hard, good alternative to bcrypt for environments where Argon2 is not available).
The key property that makes password hashing algorithms secure is computational expense — they are deliberately slow. Argon2id with current recommended parameters takes approximately 300ms to hash a password on modern server hardware. This is imperceptible to a user logging in once, but makes brute-forcing a database of stolen hashed passwords impractically slow: at 300ms per attempt, an attacker can only test 3-4 passwords per second per CPU core. A dictionary of one million passwords would take 3.5 days to test against a single stolen hash. Combined with salting (adding a unique random value to each password before hashing, preventing identical passwords from producing identical hashes), properly implemented password hashing protects users even when a database is stolen in its entirety.
The single most impactful security action most people can take today is enabling two-factor authentication on their primary email account. Email is the recovery mechanism for virtually every online account — bank, social media, work tools, cloud storage. An attacker who controls your email can reset the passwords on every account connected to it. Securing email with two-factor authentication (preferably app-based TOTP or a hardware security key rather than SMS) creates a security boundary that dramatically limits the damage of any individual credential being compromised. After email, prioritise 2FA on banking, domain registrar, and cloud storage accounts, as these represent the highest-consequence targets.
References: NIST SP 800-63B Digital Identity Guidelines · Have I Been Pwned